Weird connectivity issues... im losing my mind!

[HC_Netman]

Hi all,

 

Hoping someone can point me in the right direction as I am currently lost. Please excuse the waffle hopefully it makes sense.

 

Yesterday around 10.15am we appeared to lose internet connection (Google, gmail etc never went offline but everything else stopped loading). It lasted for about 5mins then things started to come back up but it was very intermittent. One minute a site would load and the next minute back to nothing. Sometimes sites would load but there would be no pictures or videos. This went on for about 30 minutes and then seemed to resolve itself. External phone calls were also unavailable during this time.

 

Today around 9.10am - similar intermittent behaviour. Google never seems to go offline but other websites go up and down. Sometimes an immediate refresh brings them up sometimes it takes a few minutes. Edugeek is one site that always seems to be affected. The error message when trying to load is ERR_TUNNEL_CONNECTION_FAILED.

 

I thought maybe it could be a DNS issue. I have checked our forwarders on our DCs and they point to 8.8.8.8, 9.9.9.9 and 1.1.1.1 (this one says an error occurred on the validation tab but I think it has always said that). 

 

Smoothwall has only got 1.1.1.1 and 9.9.9.9 as forwarders and our DCs as conditional forwarders.

 

All internal systems appear fine. No replication issues on DCs, I can always access network resources, internal phone calls always work.

 

Smoothwall is online and seeming to behave normally. I bypass Smoothwall filtering and still have the same connection issues.

 

My ISP investigated and said they had no outages.

 

There have been no configuration changes in the last few weeks and the problems only started yesterday. It seems to be back to normal again now without me doing anything.

 

Any advice/suggestions would be appreciated.

[colly72]

Is this happening for all users, on any device?

 

My hunch would be that it might be some sort of web filtering/firewall authentication issue as I've seen it happen before with our Sophos setup.

[HC_Netman]

Yes, all users and any device. Including visitor wireless which is on a separate VLAN.

 

I have logged a case with Smoothwall incase they have any ideas.

 

Cheers

[Davit2005]

Start with some basic ping tests when you have issues, i.e. ping the default gateway IP, ping 8.8.8.8

 

Then ping www.google.co.uk and see if it responds with the IP

 

When you have ruled out above then go deeper, might also be worth trying above tests when you have not got the issue so you know what you should expect from the ping tests. It is no good basing tests on something that does not work anyway 🙂

 

If the ping fails to the default gateway then that is a place to start looking. Basically jus work methodically to try and find the likely cause.

Edited September 19, 2025 by Davit2005

[kennysarmy]

Could there be something on your network "storming" your connection to capacity?

 

When it happens can you have a laptop setup directly connected to a spare port on your router and pull the network from the router and just test using the laptop to prove the issue is upstream?

[simpsonj]

Sounds like it could be a Smoothwall issue. The fact that Google remains accessible suggests to me that you have a policy somewhere in Smoothwall to Whitelist/prevent https inspection on Google traffic, which is why that remains accessible when other websites are not. Could be worth trying to add another website (edugeek for example) to that same policy to see if the site reminas accessible the next time you have an incident?

[HC_Netman]

28 minutes ago, Davit2005 said:

Start with some basic ping tests when you have issues, i.e. ping the default gateway IP, ping 8.8.8.8

 

Then ping www.google.co.uk and see if it responds with the IP

 

When you have ruled out above then go deeper, might also be worth trying above tests when you have not got the issue so you know what you should expect from the ping tests. It is no good basing tests on something that does not work anyway 🙂

 

If the ping fails to the default gateway then that is a place to start looking. Basically jus work methodically to try and find the likely cause.

I did try some pings the last time and they were all returning OK so it wasn't really helping. I will try again next time I notice the issue but yes I am trying to be as methodical as possible. I just wish the issue had more of a pattern that I could work with.

[HC_Netman]

20 minutes ago, kennysarmy said:

Could there be something on your network "storming" your connection to capacity?

 

When it happens can you have a laptop setup directly connected to a spare port on your router and pull the network from the router and just test using the laptop to prove the issue is upstream?

Hmm got me thinking about windows updates now. Although I would have expected the issue last week. We don't use WSUS and usually have auto download disabled but over summer I turned it on to try and help us keep things up to date. Maybe they are all trying to download at the same time... (I know not best practice I need to look into properly managing updates but thats a side issue). I will disable the auto download again and see if that helps.

[HC_Netman]

11 minutes ago, simpsonj said:

Sounds like it could be a Smoothwall issue. The fact that Google remains accessible suggests to me that you have a policy somewhere in Smoothwall to Whitelist/prevent https inspection on Google traffic, which is why that remains accessible when other websites are not. Could be worth trying to add another website (edugeek for example) to that same policy to see if the site reminas accessible the next time you have an incident?

Good spot - we do whitelist Google traffic, going to try your suggestion and see if Edugeek goes down next time! 

 

Thanks

[HC_Netman]

5 minutes ago, HC_Netman said:

Good spot - we do whitelist Google traffic, going to try your suggestion and see if Edugeek goes down next time! 

 

Thanks

Scratch that we also whitelist our own school website and that had the same issue. Plus I had the issue from a device set to bypass filtering.

 

 

[Davit2005]

1 hour ago, HC_Netman said:

I did try some pings the last time and they were all returning OK so it wasn't really helping. I will try again next time I notice the issue but yes I am trying to be as methodical as possible. I just wish the issue had more of a pattern that I could work with.

What happens if you do a speed test once when no issue evident and one with.

 

Many moons ago we had an issue at a school where I worked. A tree had fell onto a telephone cable (we were ADSL) some serious head scratching ensued. If you are on ADSL can you get a line test done?

 

The fact pings are OK certainly points to something specifically around browser, web browsing. The ping tests can rule out basic connectivity tests although they are not always successful. For instance we don't add ping to rules between servers by default on firewall zones because a ping does not prove a service is running.

 

 

Edited September 19, 2025 by Davit2005

[HC_Netman]

OK so I just had the issue again at 12.40pm - most websites would load, some a little slow, but Edugeek and our school website stopped responding completely. Ping test did show some drops to Edugeek.net. Pings to default gateway were fine. Pings to 8.8.8.8 were fine.

 

At the same time as I was having the issue I could happily go on Youtube and play full HD videos with no lag at all. 

 

The problem didn't last long enough for me to go over and connect direct to the router to see if that made any difference.

 

After about 5 mins the sites started responding again however some still showed signs of issues eg. Ebay was very slow to load, once it did the images on the page did not display at all. After a number of refreshes it eventually went back to normal.

 

Staff still reporting some slowness with various websites but no obvious pattern. 

 

I have just done a speedtest 761.2 download, 634.5 upload. Will do another one the next time things go downhill.

 

 

[mbl]

I experienced a similar issue last year, which was caused by our internet line’s DDoS protection generating false positives when all students were logging in.

Edited September 19, 2025 by mason2

[HC_Netman]

11 minutes ago, mason2 said:

I experienced a similar issue last year, which was caused by our internet line’s DDoS protection generating false positives when all students were logging in.

Thanks - I will ask the question to see if anything is kicking in that shouldn't be. 

[PaddyNewman]

Assuming a school, it's weird to see someone whitelist Google. Assume your smoothwall blocks ECH and QUIC. Google (ab)uses QUIC and it's usually exempt from filtering so worth checking. 

 

If QUIC is enabled and you block QUIC, and it breaks your Google stuff then it's a problem at the TCP 80/443 part which would be the filtering engine. 

 

I guess, if you have VoIP, are the phones working when it dies. If so I feel that reinforces the web filter. I don't know smoothwall at all, but I'd assume it's Linux under the hood and they are doing iptables/nftables stuff to direct traffic, could be falling over at that layer. Again, assumption, never touched. 

[HC_Netman]

Problem seems worse today. My offsite backups failed because of no connection. Phone lines are down.

 

I remoted in via Teamviewer (working fine).

Google sites still seem fine.

Youtube was very slow to load but once it loaded videos would play full HD.

Edugeek - failed to load but came back after refreshes.

 

Noticed Edugeek has 2 IP addresses. One pings consistently fine. The other drops everytime.

Noticed similar with our school site. 2 IP addresses ping fine. One drops everytime.

 

All internal pings are consistent. 

 

What would cause this behaviour? From home I can ping all the IPs for the websites without any issues.

 

[PaddyNewman]

Where do trace routes go to those IPs? Does one take a weird route?

[HC_Netman]

They get as far as our ISP then it is hit and miss where they go. 

 

I have just called them again and they are now reporting they have had routing issues since Thursday (when our problems started) they said this is resulting in intermittent connectivity for a number of their customers.

 

This is despite telling me there were no issues and closing my case when I first reported it. Not happy.

 

I guess (hope) this is the explanation and now just need to wait for them to resolve there end and hope it resolves my issues as well.

 

Thanks for everyones help.

[Davit2005]

16 minutes ago, HC_Netman said:

This is despite telling me there were no issues and closing my case when I first reported it. Not happy.

So many times I've had this and so frustrating. When I had my issue they point blank blamed it on a device on the network hogging the traffic, spent 2 days isolating different bits of the network, with one device plugged directly into router it was fine, browsing was fine, 2 devices and started having issues. Only when I spoke to someone else they bothered to do a physical line test then sent BT engineer to investigate and saw the tree had damaged the BT post to post copper cable.

 

Glad you got it sorted.

Edited September 20, 2025 by Davit2005

[PaddyNewman]

Do you have an edu provider or are you just getting a line from someone like BT? If it was an edu provider, I would imagine they'd be open about issues / you'd hope. I like trying to sort these sorts of problems with customers so its a shame they gave you the run around!

 

[HC_Netman]

The line is from M247 but through a reseller. It appears that M247 reported the problem once they became aware of it (probably shortly after me opening my ticket) but because my reseller had closed the ticket I didn't receive any updates. I will be speaking with my account manager today because I am not happy with how they handled this. Had me tearing my hair out thinking it was something my end when they could have simply provided an update admitting an issue. 

 

I really appreciate everyone's input. I don't post too often on here but the support when I do is always amazing.

[Accura2k7]

On 19/09/2025 at 10:13, HC_Netman said:

Curious, who is your provider?

 

 

On 19/09/2025 at 10:13, HC_Netman said:

 

Hi all,

 

Hoping someone can point me in the right direction as I am currently lost. Please excuse the waffle hopefully it makes sense.

 

Yesterday around 10.15am we appeared to lose internet connection (Google, gmail etc never went offline but everything else stopped loading). It lasted for about 5mins then things started to come back up but it was very intermittent. One minute a site would load and the next minute back to nothing. Sometimes sites would load but there would be no pictures or videos. This went on for about 30 minutes and then seemed to resolve itself. External phone calls were also unavailable during this time.

 

Today around 9.10am - similar intermittent behaviour. Google never seems to go offline but other websites go up and down. Sometimes an immediate refresh brings them up sometimes it takes a few minutes. Edugeek is one site that always seems to be affected. The error message when trying to load is ERR_TUNNEL_CONNECTION_FAILED.

 

I thought maybe it could be a DNS issue. I have checked our forwarders on our DCs and they point to 8.8.8.8, 9.9.9.9 and 1.1.1.1 (this one says an error occurred on the validation tab but I think it has always said that). 

 

Smoothwall has only got 1.1.1.1 and 9.9.9.9 as forwarders and our DCs as conditional forwarders.

 

All internal systems appear fine. No replication issues on DCs, I can always access network resources, internal phone calls always work.

 

Smoothwall is online and seeming to behave normally. I bypass Smoothwall filtering and still have the same connection issues.

 

My ISP investigated and said they had no outages.

 

There have been no configuration changes in the last few weeks and the problems only started yesterday. It seems to be back to normal again now without me doing anything.

 

Any advice/suggestions would be appreciated.

 

[HC_Netman]

M247